Alex is Sprintlaw’s co-founder and principal lawyer. Alex previously worked at a top-tier firm as a lawyer specialising in technology and media contracts, and founded a digital agency which he sold in 2015.
Contents
Managing employee data is now a core part of running a business in Australia. From onboarding details and superannuation information to performance reviews, payroll and workplace health and safety records, you’re handling sensitive, valuable information every day.
If you’re a business owner or HR manager, you want to protect your team and your business. Getting privacy compliance right builds trust, reduces risk and keeps you on the right side of the law.
In this guide, we’ll cut through the complexity and explain when Australian privacy laws apply, what “employee records” actually covers, and the practical steps you can take to manage staff information safely and lawfully.
What Counts As Employee Data (And Why It Matters)?
Employee data is any information you hold about a current or former employee, or about a job applicant. It often includes:
- Personal details (name, contact details, date of birth, address)
- Employment records (contracts, performance notes, rosters, timesheets, pay slips)
- Payroll and finance (bank account and superannuation details, remuneration)
- Workplace safety (incident reports, risk assessments, fitness for work information)
- Background checks (police checks, Working With Children Checks where relevant)
- Emergency contacts and next-of-kin information
Some of this information is “sensitive information” under Australian privacy law (for example, health information and criminal record details). Collecting, using and storing sensitive information usually requires a higher standard of care and (where the Privacy Act applies) consent, unless a specific exception applies.
There’s also a special category to be aware of: tax file number (TFN) information. TFNs are regulated by the Privacy (Tax File Number) Rule 2015 and strict Australian Taxation Office (ATO) requirements. You must only collect TFNs where required or authorised by law, use them only for lawful tax and superannuation purposes, and protect them with robust security controls.
Handled well, employee data supports smooth HR operations and a safer workplace. Handled poorly, it can lead to regulatory action, employee complaints, legal claims and reputational damage. The good news: with the right processes and documents in place, compliance becomes far more manageable.
Do Australian Privacy Laws Apply To My Business?
In Australia, the Privacy Act 1988 (Cth) applies to “APP entities”. This usually includes businesses with an annual turnover of $3 million or more, as well as many smaller businesses in specific categories (for example, private sector health service providers and some businesses that provide services to the Commonwealth). If the Privacy Act applies to you, you must comply with the Australian Privacy Principles (APPs) when handling personal information.
If your turnover is under $3 million and you don’t fall into a category that brings you into the Privacy Act, you may be a “small business” that is exempt from the APPs. Even so, you will still need to comply with other laws that touch employee information (for example, Fair Work record-keeping obligations, WHS laws, surveillance laws in your state or territory, and the TFN Rule if you handle tax file numbers). Many small businesses also choose to adopt APP-style practices as good governance and to meet employee expectations.
What About The “Employee Records Exemption”?
Private sector employers should be aware of the employee records exemption. In short, if you are an APP entity, certain acts or practices directly related to a current or former employment relationship and an employee record may be exempt from the APPs.
Key boundaries to keep in mind:
- The exemption only applies to private sector employers, and only for acts or practices directly related to a current or former employment relationship and an “employee record”.
- It generally does not cover contractors, labour hire workers engaged through an agency, or job applicants (recruitment information is usually not covered by the exemption).
- It does not apply to all kinds of personal information you may hold in the workplace (for example, data collected for non-employment purposes).
- Even where the exemption applies, other obligations still matter (for example, confidentiality duties, workplace relations laws, WHS obligations and the TFN Rule).
Importantly, proposals to reform privacy law in Australia include reviewing and potentially narrowing this exemption. The overall trend is toward greater protection for employee information. It’s smart to manage staff data transparently and securely now rather than rely on the exemption.
Do I Need A Privacy Policy?
Under APP 1, APP entities must have a clearly expressed and up-to-date Privacy Policy. Handling sensitive information alone does not trigger this obligation-being an APP entity does. That said, many small businesses choose to adopt a policy to set expectations with staff and applicants and to prepare for future law reform.
If you do need one, a Privacy Policy should explain what you collect, why you collect it, how you store and secure it, when you disclose it, and how people can access or correct their information or complain. If you receive job applications online, ensure your public-facing policy covers applicant information as well. If you want support drafting or updating it, consider putting a tailored Privacy Policy in place.
How To Handle Employee Data Lawfully And Safely
Whether you’re an APP entity or a smaller business aiming for best practice, these principles will help you manage employee data responsibly.
1) Collect Lawfully And Minimally
- Collect only what you reasonably need for your HR and business functions. Avoid asking for medical or background information unless you have a lawful reason tied to the role and workplace safety.
- Be clear and upfront at the point of collection. Use a short, plain-English notice that explains what you’re collecting and why. A tailored Privacy Collection Notice keeps everyone on the same page.
- For sensitive information (such as health data), get valid consent where required. A simple process supported by a Privacy Consent Form helps you document that consent properly.
2) Secure Storage And Access Controls
- Lock down physical files (locked cabinets, restricted rooms) and digital records (strong passwords, MFA, encryption at rest and in transit).
- Limit access to those who genuinely need the information to perform their role. Review access rights regularly, especially when staff change roles or leave.
- Establish baseline technical and administrative safeguards-an Information Security Policy sets standards your team can follow day to day.
3) Use And Disclosure
- Use employee information only for legitimate workplace purposes you’ve explained. If you need to share information externally-for example, with a payroll provider-ensure there’s a lawful basis and have appropriate contractual safeguards in place.
- Be careful with overseas disclosures. If you’re an APP entity, extra obligations apply before sending personal information overseas (for example, to a cloud provider or offshore HR support).
- Keep TFN information strictly for tax and superannuation purposes and secure it to a higher standard.
4) Access And Correction
- APP entities generally need to provide access to, and correction of, personal information they hold. However, where the employee records exemption applies (for example, for certain current or former employee records held by a private sector employer), some APP access and correction requirements may not apply.
- Even so, many employers choose to provide reasonable access to parts of the personnel file as a matter of good practice, subject to legal and operational constraints.
5) Retention And Deletion
- Don’t keep personal information longer than you need it, unless a law requires you to do so. For instance, many Fair Work records (like pay slips and timesheets) must be kept for seven years.
- When information is no longer needed and no legal retention period applies, destroy it securely or permanently de-identify it.
6) Prepare For Incidents
- Build a plan for when things go wrong. If you’re an APP entity, the Notifiable Data Breaches (NDB) scheme may require you to assess, notify affected individuals and report to the OAIC when a data breach is likely to cause serious harm.
- Document roles, timelines and communication steps in a practical Data Breach Response Plan so your team can act quickly and consistently under pressure.
- For incidents that meet NDB criteria, align your response with your plan and consider whether OAIC data breach notification is required.
Essential Documents And Processes To Have In Place
Good documents turn privacy principles into day-to-day practice. Consider the following:
- Privacy Policy: If you’re an APP entity, you must have one; many small businesses use one voluntarily to set clear expectations and standardise processes. A tailored Privacy Policy should cover both staff and applicant information where relevant.
- Collection Notices: Short notices at key touchpoints (recruitment, onboarding, WHS forms) explain what you collect and why. A consistent Privacy Collection Notice helps you get this right every time.
- Consent Forms: When you need to collect or share sensitive information, use a written Privacy Consent Form to record informed consent.
- Information Security Policy: Sets minimum security standards across the business, including passwords, access control, device security and incident reporting. See Information Security Policy.
- Data Breach Response Plan: A practical playbook to assess, contain and notify when something goes wrong. A clear Data Breach Response Plan is essential for APP entities and helpful for everyone.
- Employment Contracts: Ensure your Employment Contract sets expectations around confidentiality, appropriate use of systems and return of company property and information when employment ends.
- Workplace Policies: A Staff Handbook or suite of policies (IT and email use, remote working, social media, disciplinary process) reinforce privacy and security at a practical level. A cohesive Staff Handbook Package helps you embed these standards.
Not every organisation will need every document listed above, but most employers will need several. If you’re unsure where to start, it’s worth getting tailored privacy advice so your approach matches your operations and risk profile.
Practical Steps To Build Strong Employee Data Practices
1) Map What You Collect
List the employee information you collect at recruitment, onboarding and throughout employment. Note who receives it, where it’s stored and how long you keep it. This “data map” reveals quick wins-like reducing duplicate storage-or areas where you need tighter controls.
2) Minimise And Standardise
Only collect what’s necessary and stick to it. Standardise your forms and online processes so you don’t accidentally gather more than you need. Add collection notices and (where needed) consent language into those standard forms.
3) Tighten Access And Permissions
Apply the principle of least privilege-people should only access what they need to do their job. Review access lists quarterly and disable accounts promptly when staff move roles or leave the business.
4) Vet Your Vendors
Payroll providers, HR platforms and cloud storage vendors handle sensitive staff information. Check their security posture (encryption, certifications, data location, breach history), ensure your contract requires appropriate safeguards and consider where data is stored or accessed from.
5) Train, Remind, Repeat
Privacy is a team sport. Provide short induction training when people start and refreshers each year. Use real-world examples-misdirected emails, unlocked screens, phishing risks-and make it easy for staff to report issues quickly.
6) Plan For The Worst Day
Data incidents are stressful. Run a tabletop exercise using your Data Breach Response Plan so leaders know their roles, who to call and how to communicate with affected staff if a breach occurs. Practise now to reduce risk later.
7) Keep An Eye On Reforms
Privacy law in Australia is evolving, including proposals that would impact small businesses and the employee records exemption. Set a reminder to review your approach each year and after any major legal changes.
Key Takeaways
- Employee data covers everything from onboarding details to payroll, performance and WHS records; some of it is sensitive information and TFNs are subject to special rules.
- The Privacy Act applies to APP entities (often businesses with $3m+ turnover and certain small business categories); small businesses outside that scope still have important obligations under other laws.
- The employee records exemption is limited, applies only in specific private sector scenarios and is under review-don’t rely on it as a blanket free pass.
- Build strong foundations: collect minimally with clear notices and consent where required, secure storage and access, controlled use and disclosure, and sensible retention and deletion practices.
- Put practical documents in place-Privacy Policy (if you’re an APP entity), collection notices, consent forms, an Information Security Policy, a Data Breach Response Plan, Employment Contracts and workplace policies.
- Prepare for incidents and train your team; for APP entities, the NDB scheme may require notifications if a breach is likely to cause serious harm.
- Regular reviews and tailored advice will help you stay compliant as the laws evolve and your business grows.
If you’d like a consultation on managing employee data and privacy compliance for your business, you can reach us at 1800 730 617 or team@sprintlaw.com.au for a free, no-obligations chat.
